guloader | a7a04842ca3e817e5ae28cf389f590ba2a4f76c63e25249419bad63277b7312f

General

Target

dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
Size

652KB
MD5

3783014e89435e8f979155435933d4f0
SHA1

c711fb0d97d5d363e241ed5532c6331e0fe8aa57
SHA256

a7a04842ca3e817e5ae28cf389f590ba2a4f76c63e25249419bad63277b7312f
SHA512

611452baa7692ffd4a5f3fb73d60a0e1b4ecc8a77d1d94021c87e369909c8d9d583c5e2ae575fd7ebb95b5a3e70fb670fa4d97a4594644b74d1bb1adc9c75010
SSDEEP

12288:NgeDYSnG4nSUWbjU0WHUMTJRewXLvWkgTkVj:tDYSnG4n2bjmHUMhvKI

Score

10^/10

guloader collection downloader persistence spyware stealer

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral1/memory/1716-313-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral1/memory/1716-307-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral1/memory/1716-323-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral1/memory/1292-309-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral1/memory/1292-311-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral1/memory/1292-319-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 8 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1564-306-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/1292-309-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral1/memory/1564-314-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/1716-313-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral1/memory/1292-311-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral1/memory/1716-307-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral1/memory/1292-319-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral1/memory/1716-323-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft

Loads dropped DLL 1 IoCs

Processes:

dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe

pid process

2132 dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Tjenestetiders = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Moonblind\\Chokoladecigarerne.exe"	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

Processes:

dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe

pid process

1780 dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
1780 dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

dhl_awb_shipping_invoice_21_05_2024_000000000000024.exedhl_awb_shipping_invoice_21_05_2024_000000000000024.exe

pid process

2132 dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
1780 dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe

pid	process
1780	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
1780	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

dhl_awb_shipping_invoice_21_05_2024_000000000000024.exedhl_awb_shipping_invoice_21_05_2024_000000000000024.exe

description	pid	process	target process
PID 2132 set thread context of 1780	2132	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
PID 1780 set thread context of 1292	1780	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
PID 1780 set thread context of 1716	1780	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
PID 1780 set thread context of 1564	1780	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe

pid process

1292 dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
1292 dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe

pid	process
1292	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
1292	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

dhl_awb_shipping_invoice_21_05_2024_000000000000024.exedhl_awb_shipping_invoice_21_05_2024_000000000000024.exe

pid	process
2132	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
1780	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
1780	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
1780	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe

description pid process

Token: SeDebugPrivilege 1564 dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe

pid process

1780 dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe

description	pid	process
Token: SeDebugPrivilege	1564	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe

pid	process
1780	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

dhl_awb_shipping_invoice_21_05_2024_000000000000024.exedhl_awb_shipping_invoice_21_05_2024_000000000000024.exe

C:\Users\Admin\AppData\Local\Temp\dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
"C:\Users\Admin\AppData\Local\Temp\dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Users\Admin\AppData\Local\Temp\dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
  "C:\Users\Admin\AppData\Local\Temp\dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Users\Admin\AppData\Local\Temp\dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
    C:\Users\Admin\AppData\Local\Temp\dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe /stext "C:\Users\Admin\AppData\Local\Temp\mixnmztpnqumcfmtukibbbditbb"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1292
- - C:\Users\Admin\AppData\Local\Temp\dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
    C:\Users\Admin\AppData\Local\Temp\dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe /stext "C:\Users\Admin\AppData\Local\Temp\wccgmrerbzmqnmafdvvvmoyzuqtzvi"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
    C:\Users\Admin\AppData\Local\Temp\dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe /stext "C:\Users\Admin\AppData\Local\Temp\zwprnkwlphedpswjufpwxtsicwdaotbae"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\mixnmztpnqumcfmtukibbbditbb

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Pictures\belejrernes.lnk

Filesize
1KB

MD5
e5167f239cd424ba783984ebedb7121e

SHA1
fbdad3fc3316c434577439b495597cd2d9f69d7d

SHA256
8d9ee323fa8a85dd52c80823e1ef375fc8372fdedaa3289202eff7030849f094

SHA512
6c23316c8258b5495c73ab2d4d019182969eac5e8371f2053956757d6cc6bbf2a333c4b0011a5867b8da761e49f572ec9b66e2bf4b6c77941ca1d2d31d9eff23

Download Submit
\Users\Admin\AppData\Local\Temp\nsi20AC.tmp\System.dll

Filesize
11KB

MD5
fc3772787eb239ef4d0399680dcc4343

SHA1
db2fa99ec967178cd8057a14a428a8439a961a73

SHA256
9b93c61c9d63ef8ec80892cc0e4a0877966dca9b0c3eb85555cebd2ddf4d6eed

SHA512
79e491ca4591a5da70116114b7fbb66ee15a0532386035e980c9dfe7afb59b1f9d9c758891e25bfb45c36b07afd3e171bac37a86c887387ef0e80b1eaf296c89

Download Submit
memory/1292-309-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1292-319-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1292-308-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1292-311-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1292-301-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1564-306-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1564-305-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1564-314-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1564-303-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1716-302-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1716-304-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1716-313-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1716-307-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1716-323-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1780-296-0x0000000001520000-0x0000000006D7F000-memory.dmp

Filesize
88.4MB

Download
memory/1780-295-0x00000000004B0000-0x0000000001512000-memory.dmp

Filesize
16.4MB

Download
memory/1780-293-0x0000000077260000-0x0000000077409000-memory.dmp

Filesize
1.7MB

Download
memory/1780-325-0x0000000037BD0000-0x0000000037BE9000-memory.dmp

Filesize
100KB

Download
memory/1780-329-0x0000000037BD0000-0x0000000037BE9000-memory.dmp

Filesize
100KB

Download
memory/1780-328-0x0000000037BD0000-0x0000000037BE9000-memory.dmp

Filesize
100KB

Download
memory/2132-292-0x0000000077260000-0x0000000077409000-memory.dmp

Filesize
1.7MB

Download
memory/2132-291-0x0000000077261000-0x0000000077362000-memory.dmp

Filesize
1.0MB

Download

description	pid	process	target process
PID 2132 wrote to memory of 1780	2132	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
PID 2132 wrote to memory of 1780	2132	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
PID 2132 wrote to memory of 1780	2132	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
PID 2132 wrote to memory of 1780	2132	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
PID 2132 wrote to memory of 1780	2132	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
PID 2132 wrote to memory of 1780	2132	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
PID 1780 wrote to memory of 1292	1780	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
PID 1780 wrote to memory of 1292	1780	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
PID 1780 wrote to memory of 1292	1780	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
PID 1780 wrote to memory of 1292	1780	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
PID 1780 wrote to memory of 1716	1780	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
PID 1780 wrote to memory of 1716	1780	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
PID 1780 wrote to memory of 1716	1780	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
PID 1780 wrote to memory of 1716	1780	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
PID 1780 wrote to memory of 1564	1780	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
PID 1780 wrote to memory of 1564	1780	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
PID 1780 wrote to memory of 1564	1780	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
PID 1780 wrote to memory of 1564	1780	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads